Auth bypass in Twentyhq Twenty

CVE-2026-85055

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy. This issue is fixed in version 2.22.0.

Vulnerability class: Information Disclosure

Published · last modified .

EPSS exploit prediction

EPSS: 0.004 (37.0th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-85055: held from 0.004 to 0.004.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Weakness classification (CWE)

References